Remove website on related partner before they become internal user

Odoo 18 forbids internal users whose contact is tied to one website. Multi-website databases from Odoo 16 or 17 often have such users, and the upgrade stops while loading the website module.

This page is part of our guide on how to upgrade Odoo Community Edition. It explains what triggers the error, how to fix it by hand, and what an automated migration does about it.

The error

odoo.tools.convert.ParseError: while parsing .../addons/website/security/website_security.xml:11
Remove website on related partner before they become internal user.

The sentence is translated into the database language, so a French database shows "Supprimer le site Web d'un partenaire apparenté avant qu'il ne devienne un utilisateur interne."

Raised by

website constraint on res.users: _check_one_user_type (Odoo 18), _check_disjoint_groups (Odoo 19)

Upgrade hops

17→18, or 18→19 for databases that reached 18 without the fix

Seen when

The website module reloads its security groups

When you see it

Odoo 18 added a check to the website module: a member of the internal user group may not have a website set on its contact (res_partner.website_id). Odoo 16 and 17 had no such rule. On a multi-website database, backend users whose contact was scoped to one website were normal.

During the upgrade, website_security.xml updates the Editor and Designer group, including its implied groups. Odoo then propagates the implied groups to every member and re-validates all of them. The first internal member with a website on its contact aborts the website module load. The users named in that XML record, the superuser and the admin, are often not the ones that fail; the failing users come in through the group propagation.

Root cause

Find the internal users whose contact has a website:

SELECT u.id, u.login, p.id AS partner_id, p.website_id
FROM res_users u
JOIN res_partner p ON p.id = u.partner_id
WHERE p.website_id IS NOT NULL
  AND u.id IN (
    SELECT r.uid FROM res_groups_users_rel r
    JOIN ir_model_data d
      ON d.model = 'res.groups' AND d.res_id = r.gid
     AND d.module = 'base' AND d.name = 'group_user');

How to fix it

Clear the website on those contacts in the source database, then upgrade. For internal users the field has no effect on what they can do in the backend; portal and public users keep their website scope because the statement only touches internal users.

Before you change anything: Back up the database before running any UPDATE or INSERT below, and try it on a copy first. These statements change data directly, outside the Odoo ORM.

UPDATE res_partner p
SET website_id = NULL
FROM res_users u
WHERE u.partner_id = p.id
  AND p.website_id IS NOT NULL
  AND u.id IN (
    SELECT r.uid FROM res_groups_users_rel r
    JOIN ir_model_data d
      ON d.model = 'res.groups' AND d.res_id = r.gid
     AND d.module = 'base' AND d.name = 'group_user');

-- res_users keeps a stored copy of the value
UPDATE res_users u
SET website_id = NULL
FROM res_partner p
WHERE p.id = u.partner_id AND p.website_id IS NULL AND u.website_id IS NOT NULL;

In the user interface the same change is: open each internal user's contact and empty its Website field. On Odoo 18 or 19 the same message appears when you try to turn a website-scoped portal user into an internal user; clear the field on the contact first.

How OCU handles it

OCU runs a base pre-migration step on the 17→18 and 18→19 hops that clears the website on the contacts of internal users only, before any module loads its data. Portal and public users keep theirs. The check looks at group membership the same way Odoo does, so users who would only fail through group propagation are covered too.

A free test migration shows whether your database runs into this or any other upgrade error before you change anything on your production server.

Frequently asked questions

Do users lose access to a website when I clear the field?

No. For internal (backend) users the website on their contact does not restrict anything in the backend. Portal users keep their website because the fix only touches members of the internal user group.

Why does the error point at line 11 of website_security.xml?

That record updates a website group. The constraint fires while Odoo writes that group and re-validates its members, so the parser reports the XML line even though the real problem is in your user data.

Related

• Element cannot be located in parent view
• TypeError: 'bool' has no len() in Odoo 19
• Migrate Odoo 17 to 18
• Migrate Odoo 16 to 18
• Migrate Odoo 16 to 19
• Common Odoo migration problems
• Odoo migration checklist
• How to upgrade Odoo Community Edition